Fedora Account System
Red Hat Associate
Red Hat Customer
A out-of-bounds read vulnerability in the smc protocol stack in the Linux kernel. References: https://bugzilla.redhat.com/show_bug.cgi?id=2040604
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 2047638]
Hi Are there any details available for this CVE? The referenced bug is not public. Is this something already with a fix in mainline? Regards, Salvatore
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-0400
In reply to comment #6: > Hi > > Are there any details available for this CVE? The referenced bug is not > public. Is this something already with a fix in mainline? > > Regards, > Salvatore Hi Salvatore, Not yet fixed in the mainline, thanks to ziming zhang, who has reported this. https://bugzilla.redhat.com/show_bug.cgi?id=2040604
This comment was flagged a spam, view the edit history to see the original text if required.
In recent years, Malaysia has witnessed a remarkable surge in the field of data science. As technology continues to advance, the nation's focus on harnessing the power of data has propelled it to the forefront of the data science landscape in Southeast Asia. <a href="https://360digitmg.com/malaysia/certification-program-in-data-science"> data science in malaysia</a>
Python Course in Kolhapur will make you an expert in Python Programming for Web development. Get In-Depth Practical vulnerability in Python libraries including Pandas, matplotlib, scipy, numpy, PyGTK, SymPy, Flask, PyTorch and information visualizations together with Real-World Projects. Become a Best Python Developer by enrolling with SevenMentor classroom and online course. <a href='https://www.sevenmentor.com/python-course-in-kolhapur'>python classes in kolhapur</a>
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days
good one very informative <a href="https://datascienceschool.in/">Data Science Course in Hyderabad</a>
The bug report addresses CVE-2022-0400, an out-of-bounds read vulnerability in the Linux kernel's SMC protocol stack, which could lead to remote DoS attacks. The issue was tracked across distributions but was later marked as "CLOSED NOTABUG," meaning no further action was taken. <a href="https://dataanalyticsmasters.in//">Data Analytics Course In Hyderabad</a>
Is there any detailes for this vulnerability? It has been over two years, and the CVE remains undisclosed.
(In reply to Jiahao Li from comment #20) > Is there any detailes for this vulnerability? It has been over two years, > and the CVE remains undisclosed. This is not fixed in the mainline yet, please see comment #10. Reporter is unresponsive se we don't more about it.
This CVE is being triaged for the Yocto Project / OpenEmbedded kernel recipes [1]. The public record for CVE-2022-0400 identifies no affected code: this bug is closed NOTABUG with "There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code", and the originating report, bug 2040604 (marked "not public" in Debian's security tracker), is not accessible. That statement is specific to Red Hat's kernel configuration. Distributions building other configurations cannot triage this CVE without knowing which source files or Kconfig options were implicated. Could bug 2040604 be made public, or at least the affected files or options be named here? If the report was found invalid for all configurations rather than merely not built in RHEL, stating that would also settle it. [1] https://lore.kernel.org/openembedded-core/20260812072842.1176341-6-junjie.cao@linux.dev/
Red Hat PSIRT responded to comment 22 through a support ticket (PSIRTSUPT-22046). Bug 2040604 remains internal, but they identified the affected code: in CONFIG_SMC builds, the v2_ext_offset field of an incoming CLC proposal message is used to compute a memory offset without validation - smc_clc_msg_hdr_valid() -> smc_clc_msg_prop_valid() -> smc_get_clc_v2_ext() (net/smc/smc_clc.h) - an out-of-bounds read. This matches mainline history. The unchecked read exists since V2 CLC proposal parsing was added in v5.10 (commit 8c3dca341aea); at the time of this report smc_get_clc_v2_ext() checked the offset only for zero and smc_clc_msg_prop_valid() dereferenced the result on the server receive path. Fixed in v6.13-rc4 by commit 7863c9f3d24b ("net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg"), which the kernel CVE team assigned CVE-2024-49568 (introduced in 5.10, fixed in 6.6.68, 6.12.7 and 6.13): https://lore.kernel.org/linux-cve-announce/2025011142-CVE-2024-49568-e5f6@gregkh/ So CVE-2022-0400 describes the defect later fixed as CVE-2024-49568. Linking the two records, or adding the fix information to CVE-2022-0400, would let downstream trackers close it. I am recording it as fixed from 6.13 in the Yocto Project / OpenEmbedded kernel triage: https://lore.kernel.org/openembedded-core/20260812072842.1176341-1-junjie.cao@linux.dev/